coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Harden WP-0024 recovery execution gates
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa
This commit is contained in:
codex 2026-08-22 14:00:18 +02:00
parent 08a3dd7660
commit 3f9e4535d1
10 changed files with 848 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

24
workplans/RAILIANCE-WP-0024-audit-core-custody-and-recovery-coordination.md
View file

@ -113,6 +113,20 @@ checks without observing Secret data. The live revocation still waits for an
approved window, audit-core/rapp-postgres acknowledgement, a separately
approved synthetic-load contract, and a named abort operator.
**Harness hardening (2026-08-22):**
`scripts/audit-core-database-lease-recovery.py` now implements the attended
orchestration but cannot run from repository access alone. It requires a
value-safe approved receipt based on
`docs/audit-core-database-lease-approval.example.json`, a revision-pinned
synthetic-load driver, exact confirmation, an open ≤15-minute window, all
three owner acknowledgements, and at least five minutes before the ordinary
lease refresh. OpenBao metadata inspection corrected the selection contract:
lease lookup exposes issue/expiry/TTL, not a database username. The harness
therefore aborts unless the exact runtime prefix has one live handle whose
issue time coheres with the ExternalSecret refresh. A live read-only check
observed exactly one handle, 0.073 seconds of issue/refresh skew, and no secret
values. It was not revoked.
## T03 — Define the coordinated railiance01 reboot exercise
```task
@ -144,6 +158,16 @@ the intentionally non-automated gates: an approved window and owner set,
provider-console access, a current OpenBao Raft snapshot receipt, 2-of-3 Shamir
quorum availability, and a named abort operator.
**Snapshot gate hardening (2026-08-22):** reboot preflight no longer accepts a
file-existence assertion as snapshot evidence. A receipt based on
`docs/openbao-reboot-snapshot-receipt.example.json` must be no more than 24
hours old, match the live OpenBao cluster id and a possible Raft applied index,
carry distinct non-placeholder plain/encrypted hashes, and attest encryption,
off-host persistence, verification, and absence of secret material. The
pending example intentionally fails. Creating the secret-bearing snapshot and
its off-host copy remains an attended platform-custody action near the future
reboot window; no snapshot was created in this implementation step.
## T04 — Route the contracts and approval gates
```task